Email Blacklisting

I agree nihil .... it's easy to lose sight of who the real criminals are. Someone who forgets to lock their car door may be careless and unwise, but the person who comes along and steals the car has committed the offence.

It's the same attitude you see with road accidents, ie "that dangerous single carriageway A1". Well, it's not the road that causes the accidents it's the drivers on it and while you can do your best to improve the road, at the end of the day the accountability is with the road user. If a road isn't safe then you drive at a sensible speed and you don't overtake or get too close to the car in front. You set off in plenty of time so you don't get frustrated if you're stuck behind a wagon limited to 40 mph.

Sorry, this thread's now gone off at yet another tangent! :D

Actually, I'n not sure this thread has gone off track... Some hard issues have risen from this that are pertenant to the current anti-spam stage. My original message addresses one facet. However the underlting theme has emerged quite strongly: Who are the real victims?

Who do we go after?

1. Corporations or for that matter any business, large or small should obviouly know what they are doing.

2. Any spam friendly ISP. Lets be honest, there are simply too damned many of these out there that are there just for a quick buck.

3. Any business telling consumers they are not at risk and they don't need an antivirus/spam package.

4. Any business that does not respond quickly to customer complaints about spam/viruses.

I'm sure there are others... But this is a good start.

It is very true that there are no internation laws governing spam, bust just about every country on the planet has some sort of law for its citizens. There is also the final line of the Internet - IANA. They have the authority and power to shutdown a block of IP addresses and take out any ISP/Business that allows illegal activity.

Given the context of this thread, who are the real victims? Wheather by RBL, Country blacklists, methods that may exist now or to come, the real victims are the very people we are trying to protect, the basic uneducated computer user.

This now brings us to the crux of the issue: How do we put an end to the spambots, phishing scams, and the like?

Official Fact: The world's largest spam infested country is The United States of America, which also has the weakest antispam laws in the world. This fact is based upon tabulations of IP addresses listed by origin from RBLs, ISPs, various antispam companies and end users reporting spam.

We can't change the world, but we should at least be able to fix our own backyard!

Quote:

---

Originally Posted by frpeter

We can't change the world, but we should at least be able to fix our own backyard!

---

Well said!

Quote:

---

Originally Posted by frpeter

1. Corporations or for that matter any business, large or small should obviouly know what they are doing.

2. Any spam friendly ISP. Lets be honest, there are simply too damned many of these out there that are there just for a quick buck.

3. Any business telling consumers they are not at risk and they don't need an antivirus/spam package.

4. Any business that does not respond quickly to customer complaints about spam/viruses.

I'm sure there are others... But this is a good start.

---

To #1 you should add "Institutions" such as schools, colleges, healthcare and non-profits. These are the weakest link, as their funding encourages them not to invest in the right quantity and quality of staff.

My suggestion for these is they should form groupings and employ a central IT security consultancy. In this country we have "Regional Health Authorities" and "Local Education Authorities" which would be a convenient administrative grouping that is already set up.

Small businesses could possibly use their trade associations or local Chamber of Commerce? Maybe even local government could provide it as a service.

My thinking is that by consolidating funding you would reduce individual cost burdens, and finance a much more professional and effective operation?

#2 I cannot really comment on this one as we don't have that many ISPs over here. I do believe that ISPs should accept more responsibility for internet security rather than their "Pontius Pilate" attitude of washing their hands of it.

#3 I find this one difficult, as there are those who would argue that these products are always one step behind. I would make it a legal requirement that any retail sale of a PC should include a government approved "security manual" which would advise the end user on security matters and "safe computing".

#4 I am not sure what you mean by this? I know for a fact that most home users have never even heard of a spoofed IP address or know how to read an e-mail header :D They certainly should not respond to the spam e-mail, as that merely confirms them as a target.

I feel that this is a Federal government duty. Like determine who will benefit if the spam offer is taken up, and go after them. Even to the extent of using the IRS.................... a thorough tax audit generally gets the message across............ and I very much doubt if the scum involved have filed returns that would bear close scrutiny :cool:

Just a few thoughts :)

Quote:

---

Originally Posted by nihil

#4 I am not sure what you mean by this? I know for a fact that most home users have never even heard of a spoofed IP address or know how to read an e-mail header :D They certainly should not respond to the spam e-mail, as that merely confirms them as a target.

---

Perhaps this is best described with an example. I had a flood of spam hit my server Sunday night. When I filed a complaint at the proper abuse address, I got a message back that the abuse addresses doesn't exist. This qualifies as a non-responsive business. I have also received errors back that my complaint was spam and (one of my favorites for stupidity) the abuse address doesn't handle abuse complaints.

As far as I am aware you run a Whois? and it will tell you the ISP to whom you report the abuse.

If you get the sort of responses you are getting, these should be from the ISP not their customer, which is what I understood you to mean by "business" Sorry if I misread you, but I thought you had that covered in #2 which I understood to cover rogue ISPs.

Surely this brings another "usual suspect" into the equation.......... the Domain Registrars, who issue the address blocks to the ISPs?

A possible solution here is for some sort of regular testing of the abuse addresses? If the response is as you have described then the address block should be banned.

If the Domain Registrars will not accept this responsibility then their authority to assign address blocks should be rescinded.

IANA are not doing their job properly, are they? and we seem to have identified two more "Pontius Pilates" :cool:

BTW, I agree that this thread has become a lot more interesting since its scope has broadened.

:)

Trouble is, a whois will sometimes only give you a block of dynamic addresses. It doesn't always even pinpoint the country - my own location comes up as the US, which isn't correct.

Quote:

---

BTW, I agree that this thread has become a lot more interesting since its scope has broadened.

---

Good :) I was a bit worried about leading it off topic!

Moira,

Please take a look at this site: http://www.dnsstuff.com in the middle column there is an option to get IP information.

The trouble with a lot of IP geographic locators is that they are frequently based on data that is now very obsolete. The one on the front page of AO is based on data that hasn't been maintained for three years or so :)

The problem is that IP address blocks keep getting reallocated so the location tables need to be maintained on a very regular basis. I believe, however that there are subscription services that are pretty accurate (say 95%).

I don't think that the Whois? giving you a block of dynamic IP addresses is a particular problem. It should give you the report abuse contact, and they will naturally require evidence that contains time and date information?

The real question to me, is whether they actually do anything about it?

frpeter seems to be encountering situations where the Whois? abuse data is incorrect, suggesting a dubious registration.

nihil no, from personal experience they don't do anything about abuse reports.

A whois on myself:

Location: United States [City: Reston, Virginia]

Just a bit out :)

Hi Moira,

Let me make a wild guess..................your ISP is AOL?

They have a rather strange architecture, and yes, you may appear to be in the USA, I believe that Whois? shows you their headquarters or something. ;)

They can trace back with the right information though.

:)

Correct. But actually getting the right information to trace back to a particular person wouldn't be easy.

I use zcw (http://www.cyberabuse.org) and AbuseNet (http://www.abuse.net) to cross check my addresses for abuse complaints. They stay up-to-date and have a high reliability.

Here's an AOL lookup using zcw:

[ Informations about 172.145.56.102 ]

IP range : 172.128.0.0 - 172.191.255.255
Network name : AOL-172BLK
Infos : America Online
Infos : 22000 AOL Way
Infos : Dulles
Infos : VA
Infos : 20166
Country : United States of America (US)
Abuse E-mail : [email protected]
Source : ARIN

This is what my BlackListed page uses.

My biggest headache as a system administrator is simply greed infested businesses and ISPs that rather promote spam and the illegal phishing scams.

Yep, the U.S. leads in spam with China and Russia picking up the second and third spots respectively.

So what does this say about laws locally or abroad? No one who makes laws is capable of carving legislation that chokes this stuff at the source is what it tells me. Why? Because those who are making the laws truly do not understand the beast they deal with. Let's also not forget about those politicians who get greased by special interest groups, marketers and such and in the process, ram it right up your a$$. Who cares about spam when you're getting a nice under the table cash flow to support your hooker, dope and yacht expenses. Sadly, I'm not joking.

At the end of the day, you're left to defend yourself against the onslaught of penis enlargement spam, King Jaffoo and his need to transfer $110,000,000 to your bank account, etc.

This leads me down the road of proposed technical solutions including, but not limited to secure DNS (SDNS) and various RFC drafts for verified e-mail senders/receivers via (dare I say) add on protocols or additions to existing messaging protocols (SMTP, POP3, IMAP, etc.).

If you want to know who the real victim is, that's easy; it's me. I have to constantly tune SPAM appliances, I have to submit abuse info to ASN net ops, I have to bitch at end users (high impact awareness training) about clicking on the dancing money to win a prize, and so on.

AOL poses a very special problem when blocking subscribers. Since all their traffic routes through their Dulles facility and because they have hundreds of netblocks AND because your trouble user can get an address assigned from any of those netblock pools, the administrative dance you need to do to keep nasty folks from AOL in check becomes tiresome. The good news is that some of their OPS people have finally joined the vetted mailing list and I can now hand over the info and they handle my issues quickly from within. For those who do not have that luxury, I weep.

--TH13

Sounds like AOL .... awkward to the end :) I have to say they keep spam out of my inbox very efficiently though, from an end user point of view.

Quote:

---

Originally Posted by thehorse13

Yep, the U.S. leads in spam with China and Russia picking up the second and third spots respectively.

---

Actually, I have to say that china has been making progress. The only ISP from china that I still see in my longs in hinet.net. Other than that, I get next to nothing from china and russia. the 4-1-9 on the other hand, now thats a blooming scurge to the universe and I never thought the human race was filled with so many stupid people that actually belive a strange person from GOD knows where is actually going to find some benefactor for $<whatever> millions???

Intellegience is truly endangered and stupidity is pandemic.

Quote:

---

Originally Posted by thehorse13

So what does this say about laws locally or abroad? No one who makes laws is capable of carving legislation that chokes this stuff at the source is what it tells me. Why? Because those who are making the laws truly do not understand the beast they deal with. Let's also not forget about those politicians who get greased by special interest groups, marketers and such and in the process, ram it right up your a$$. Who cares about spam when you're getting a nice under the table cash flow to support your hooker, dope and yacht expenses. Sadly, I'm not joking.

---

It tells me that there are less corrupt and greedy lawmakers abroad then local. I believe they do understand and don't give a damned as long as their pockets are filled.

My basic point is there is still no excuse we can't fix our own backyard.

Perhaps its time to bring back the boycott... It worked well against netscape.com.

Quote:

---

Originally Posted by thehorse13

AOL poses a very special problem when blocking subscribers. Since all their traffic routes through their Dulles facility and because they have hundreds of netblocks AND because your trouble user can get an address assigned from any of those netblock pools, the administrative dance you need to do to keep nasty folks from AOL in check becomes tiresome. The good news is that some of their OPS people have finally joined the vetted mailing list and I can now hand over the info and they handle my issues quickly from within. For those who do not have that luxury, I weep.

---

AOL is one of the easiest ISPs I've had to work with. They're quick, responsive and lightening harsh on spammers. Though I do have to agree on the admins less fortunate. I guess there is something to be said about being a chronic pain in someone's @$$...

frpeter, whilst I personally applaud you enthusiasm, I hate to have to rain on your parade :(

If you get sorted in the USA and we get sorted in the EU it will still be a drop in the ocean?

HEY, if the EU reduce carbon and greenhouse gasses emissions by 25%......... it will have no effect whilst China and India and the USA carry on as they are?

I am reminded of the expression:

"It is like teaching a pig how to sing.............it is a waste of your time; and frequently annoys the pig"

:D

nihil, a few people echo the sentiments of frpeter. Seb and Andrew from Adslguide (now known as ThinkBroadband) said they were most impressed by them when they were being added to the site. Completing all the requests very efficiently, they took Seb and Andrew out to lunch even (so that's where my subscription goes :( )

That account also gets less spam than any other - by a long way.

Quote:

---

Originally Posted by nihil

frpeter, whilst I personally applaud you enthusiasm, I hate to have to rain on your parade :(

If you get sorted in the USA and we get sorted in the EU it will still be a drop in the ocean?

HEY, if the EU reduce carbon and greenhouse gasses emissions by 25%......... it will have no effect whilst China and India and the USA carry on as they are?

I am reminded of the expression:

"It is like teaching a pig how to sing.............it is a waste of your time; and frequently annoys the pig"

:D

---

One drop less is one drop less and at least an attempt in moving in the right direction. If we make no attempt then we gain nothing. To try and fail is a success, you still gain knowledge and wisdom. To not try at all is truly a failure with nothing gained.

If everyone cleaned up their own backyards, before you know it, there be no spam.

Moira,

I go back to the original post................ block China, Nigeria and a whole host of others...................:D

frpeter was complaining about this in his original post?

I say do it and be damned :fpissed:

No prisoners, no surrender?............. have you noticed that "war criminals" are always on the losing side?
;)

Quote:

---

Originally Posted by nihil

I go back to the original post................ block China, Nigeria and a whole host of others...................:D

frpeter was complaining about this in his original post?

I say do it and be damned :fpissed:

No prisoners, no surrender?............. have you noticed that "war criminals" are always on the losing side?
;)

---

Blocking China and Nieria isn't going to stop spam that goes through broken relays. Nice idea, but not practical though. Administrators fixing their machines would however have an effect.

I'm still getting hits from machines infected with Code Red...

Quote:

---

Originally Posted by frpeter

Blocking China and Nieria isn't going to stop spam that goes through broken relays. Nice idea, but not practical though. Administrators fixing their machines would however have an effect.

I'm still getting hits from machines infected with Code Red...

---

So are we............................. have you noticed that there is a preponderance of schools, colleges, heathcare, local government, libraries and so on? As I posted earlier, these are the "soft underbelly" of the IT community. They need to circle their waggons to fight off the hostiles? :D

My concept of blocking whole countries or at least ISPs, is to give them a "heads up" and force them into taking action.

Are you aware that after oil, internet fraud is the second largest industry in Nigeria?

Incidentally, I think that you mean "open relays"? ;)

EDIT: //off topic//

Nigerians are great people............... my man had to get his parents to get one of those hats made to fit me........but the Boer bush hat and the Stetson were the same............ I guess I have an odd shaped head? when I have my hair cut short, bumble bees use it as a landing strip:D

Also, ***** has the largest Guinness brewery in the World:drink:

EDIT #2

Hilarious! the capital city of Nigeria is considered to be an obscenity?

Quote:

---

Originally Posted by nihil

So are we............................. have you noticed that there is a preponderance of schools, colleges, heathcare, local government, libraries and so on? As I posted earlier, these are the "soft underbelly" of the IT community. They need to circle their waggons to fight off the hostiles? :D

---

Just bitch a little lorder or higher on the food chain. I was getting a lot of spam from a universiry for a while... After complaining to their System Administrator and getting nowhere, I decided to write a little editorial in their city's main newpaper blasting (politely of course) the universitty for allowing fraud and doing nothing about it. I received a personal apology from the university president and the spam stopped. My guess is some heads rolled over this. The editorial was free... so I spent no money and got a sewage hole cleaned up. Persistence and fortitude do pay off.

Quote:

---

Originally Posted by nihil

My concept of blocking whole countries or at least ISPs, is to give them a "heads up" and force them into taking action.

Are you aware that after oil, internet fraud is the second largest industry in Nigeria?

Incidentally, I think that you mean "open relays"? ;)

EDIT: //off topic//

Nigerians are great people............... my man had to get his parents to get one of those hats made to fit me........but the Boer bush hat and the Stetson were the same............ I guess I have an odd shaped head? when I have my hair cut short, bumble bees use it as a landing strip:D

Also, ***** has the largest Guinness brewery in the World:drink:

EDIT #2

Hilarious! the capital city of Nigeria is considered to be an obscenity?

---

Not always an open relay. The Nigerian scam has left Nigeria and spread world wide. Blocking Nigeria will only block 5% is the spam. However; forwarding all the 4-1-9 spam to the Bank of Nigeria will and has (in my case) made and impact.

Well, block Nigeria, and China and Russia.............. that should get rid of 60%

Which leaves you with the USA, where you can actually legislate, and us IT pros can make money?

:D

This sums up this entire thread. Notice the points made.

http://www.nytimes.com/2006/12/06/te...rssnyt&emc=rss

Enjoy.

--Th13

This is the scary part...

Quote:

---

antispam company in San Jose, Calif., reports that 250,000 new computers are captured and added to these spam “botnets” each day.

---

:eek: "each day" that's a lot of unsecured PC's....:fpissed:

Quote:

---

Originally Posted by dalek

This is the scary part... :eek: "each day" that's a lot of unsecured PC's....:fpissed:

---

Translation: Thats a lot of uneducated victims that have no idea it takes only 6, yes that is a SIX, seconds to hack a M$ Windows computer.

I agree 100% of the pissed part.